Methods and systems for improved risk scoring of vulnerabilities

Abstract

A security tool can identify vulnerabilities in a computing system and determine a risk level of the vulnerabilities based on base and optional CVSS vectors and additional factors that represent the evolving nature of vulnerabilities. Likewise, the security tool can determine an overall risk for vulnerabilities, an asset, and / or a collection of assets that encompasses a global view of an asset's risk and / or collection of assets' risk, business considerations of an entity that own and controls the asset and / or the collection of assets, and the entity's associations.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS[0001]This application claims priority to U.S. Provisional Patent Application Ser. No. 61 / 535,723 filed on Sep. 16, 2011, the disclosure of which is incorporated in its entirety by reference herein.FIELD[0002]Aspects of the disclosure relate generally to computer security.DESCRIPTION OF THE RELATED ART[0003]In today's distributed computing environments, security is of the utmost importance. Due to the rise of wide-area public networks, users have unlimited access to content, e.g. data, files, applications, programs, etc., from a variety of sources. Additionally, the users' connection to the public networks provides a window for malicious entities to attack the users' computing systems. Malicious entities utilize this ease of accessibility and anonymity to attack the users. For example, the malicious entities can plant viruses, Trojans, or other malicious agents in publicly available content in order to attack the users' computing systems and st...

AI Technical Summary

Problems solved by technology

A vulnerability can be any type of weakness, bug, and / or glitch in the software and hardware of a computing system.

The CVSS does afford the ability to rank one vulnerability against another, but nuanced organizational analysis has proved problematic, partly due to the ordinal nature of the scoring system, and partly due to large gaps in the underlying metrics.

Nor does the CVSS facilitate any sense of indirect impact or likelihood involving integrated or adjacent organizations.

Most importantly, it does not account for numerous factors that increase or mitigate risk that must be taken into consideration to truly understand an organization's risk posture—factors that have proven to play a role just as strong as the base, environmental, and temporal vectors that comprise the CVSS.

Images